The Linux kernel Btrfs filesystem had a vulnerability (CVE-2026-74723) where reading a specially crafted inline LZO compressed file extent without a valid segment header caused a slab-out-of-bounds read in the lzo_decompress function. This was due to the decompression code attempting to read a segment header that did not exist, leading to a read beyond the extent buffer boundary and triggering a KASAN error. The fix involves validating the compressed extent's total length to confirm it contains at least one LZO header, one segment header, and a non-zero payload before decompression proceeds.

This vulnerability could cause a kernel slab-out-of-bounds read when processing crafted Btrfs images with malformed inline LZO compressed extents. While the input data does not specify exploitation details or impact beyond the KASAN detection, such out-of-bounds reads in kernel code can potentially lead to system instability or crashes. There is no indication of known exploits in the wild.

A fix has been implemented in the Linux kernel to validate inline LZO compressed extents before decompression, preventing out-of-bounds reads. Users should apply the official Linux kernel update that includes this fix. Since no patch links or affected versions are provided, check the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.